Modify system span merge logic #24200

**Phenomenon and reproduction steps**

**Root cause and solution**

**Impactions**

**Test method**

**Affected branch(es)**

* main

**Checklist**

- [ ] Dependencies update required
- [ ] Common bug (similar problem in other repo)

HOW-TO-GET-SPAN-LIKE-DATA.md

@@ -77,8 +77,8 @@
   - `tap_side != system span`时，每条`flow`的`_id`最多只有一来一回两条， 大于等于两条
   - `vtap_id`, `tap_port`, `tap_port_type`, `l7_protocol`, `request_id`, `tap_side`, `flow_id`不同
   - `request`的`start_time`大于`response`的`start_time`
-- 系统Span的`flow`满足以下条件才合并
-  - 应用协议为DNS，request_flow的type==session
+- 非DNS协议的系统Span的`flow`满足以下条件才合并
+  - request_flow的type==session
   - response_flow的type==response
   - request_flow的cap_seq_1+1==response_flow的cap_seq_1
 - 合并字段，被合并的`flow`会将`原始flow`中缺少的字段补充进去

README.md

@@ -20,6 +20,6 @@ So, here is to convert the existing Flow Log Event into Span-like data, that is:
 - Sort the merged data and build Span-like data that conforms to the call stack.
 
 ## Others
-For details, please refer to [here](https://github.com/deepflowio/deepflow-app/blob/feature-edit-desc/HOW-TO-GET-SPAN-LIKE-DATA.md)
+For details, please refer to [here](https://github.com/deepflowio/deepflow-app/blob/main/HOW-TO-GET-SPAN-LIKE-DATA.md)
 
 

app/app/application/l7_flow_tracing.py

@@ -1293,13 +1293,12 @@ def merge_flow(flows: list, flow: dict) -> bool:
             equal = False
         if request_flow['tap_side'] in [
                 TAP_SIDE_SERVER_PROCESS, TAP_SIDE_CLIENT_PROCESS
-        ]:
+        ] and request_flow['l7_protocol'] == L7_PROTOCOL_DNS:
             # 应用span syscall_cap_seq判断合并
-            if request_flow['l7_protocol'] != L7_PROTOCOL_DNS or request_flow[
-                    'syscall_cap_seq_1'] + 1 != response_flow[
-                        'syscall_cap_seq_1'] or not (
-                            request_flow['type'] == L7_FLOW_TYPE_SESSION and
-                            response_flow['type'] == L7_FLOW_TYPE_RESPONSE):
+            if request_flow['syscall_cap_seq_1'] + 1 != response_flow[
+                    'syscall_cap_seq_1'] or not (
+                        request_flow['type'] == L7_FLOW_TYPE_SESSION
+                        and response_flow['type'] == L7_FLOW_TYPE_RESPONSE):
                 equal = False
         if equal:  # 合并字段
             # FIXME 确认要合并哪些字段